[wp-trac] [WordPress Trac] #48693: Silence ini_set caused error or check if function_exists first

[WordPress Trac]

#48693: Silence ini_set caused error or check if function_exists first
-------------------------------------+-----------------------------
 Reporter:  drazon                   |       Owner:  SergeyBiryukov
     Type:  defect (bug)             |      Status:  accepted
 Priority:  normal                   |   Milestone:  Future Release
Component:  Bootstrap/Load           |     Version:  5.3
 Severity:  major                    |  Resolution:
 Keywords:  needs-testing has-patch  |     Focuses:
-------------------------------------+-----------------------------
Changes (by maltfield):

 * severity:  normal => major


Comment:

 @jrf Security should be layered.

  * https://en.wikipedia.org/wiki/Defence_in_depth

 As stated in my other ticket (linked above), it absolutely *is* best-
 practice to disable dangerous functions like `exec()` in php by adding
 them to `disable_functions` in `php.ini`. Of course, doing so necessitates
 disabling `ini_set()` as well, as that would just allow a script to re-
 enable disabled functions like `exec()`

 It is common practice to do this. It is not silly.

 Note that I'm not much of a php developer; my profession is working as a
 security consultant. Disabling `ini_set` in `php.ini` is common practice
 for many, many orgs.

 > If WP would need to work around that, the same could be argued for
 literally every single function call to a PHP native function as they
 could all be disabled.

 For infamously dangerous functions (such as `shell()`, `exec()`,
 `ini_set()`, etc), wordpress *should* always check to see if it has access
 to a function before trying to call it. Developers shouldn't assume that
 admins will allow them to do dangerous things that are very commonly
 disabled for obvious security reasons.

-- 
Ticket URL: <https://core.trac.wordpress.org/ticket/48693#comment:23>
WordPress Trac <https://core.trac.wordpress.org/>
WordPress publishing platform